There is a comfortable assumption that serious attackers are only interested in critical national infrastructure. The power networks, the water companies, the hospitals. It is worth letting go of that. The most damaging UK incidents of the past year hit a carmaker, two supermarkets and a department store, and Jaguar Land Rover’s breach alone is reported to have cost the business around £1.9 billion.
This matters most when you look at who is doing it. Alongside the criminal ransomware crews, state-backed groups are pre-positioning inside ordinary commercial networks, and their objective is not always extortion. It is disruption at scale, and disruption does not care what sector you are in. If taking you offline creates enough pain, to you, to your customers, or to whoever depends on you further down the chain, then you are worth compromising.
For UK mid-market businesses, cybersecurity risk increasingly extends beyond direct attacks to supply chain security, third-party risk management and operational resilience.
Mid-market businesses are often the easiest route in, which is why supply chain compromise was the single costliest factor for UK organisations last year.
So a mid-market business in 2026 faces the same attackers as a FTSE 100, the same ransomware crews and the same AI-accelerated exploitation, without the security team or budget to match.
For years the answer has been to buy more tools. A firewall here, an email filter there, a bolt-on for whatever made the news that month. You end up with a drawer full of controls and no real design.
“We’ve got security tools” is very different to “we’d cope if it went wrong on a Tuesday”.
Without a framework behind it, buying more stuff is just throwing things at the wall to see what sticks. You spend real money and still can’t say, honestly, whether you’re covered.
Start With a Framework, Not a Shopping List
A framework gives you something a shopping list never does: a clear picture of what you’re trying to cover, so every control has a reason to exist and the gaps show up instead of hiding.
For a mid-market business I’d recommend the NIST Cybersecurity Framework 2.0.
Its six functions, Identify, Protect, Detect, Respond, Recover and Govern, are already the language your board, your insurer and your regulator use, so nobody has to translate.
Cyber Essentials sits almost entirely within one of the six NIST functions.
The mistake I see most often is stopping at the basics.
Cyber Essentials Plus is a good minimum cybersecurity standard for UK organisations. It stops something like 95% of common attacks, and it’s worth certifying against.
But it sits almost entirely inside one function, Protect.
It says nothing about whether you can spot an attack, respond to it or recover from it: no monitoring, no incident plan, no tested restore, no board oversight.
So get certified, then keep going. The rest of the framework is where resilience actually comes from.
Choose the framework first, then let it tell you what to spend on.
If you’re asking “What cybersecurity framework should a mid-sized business use?”, NIST CSF 2.0 provides one of the most practical and widely adopted structures for aligning security controls, governance and cyber resilience outcomes.
Defend Better: Identity First, Assume Breach
“I’m safe behind a firewall” stopped being true years ago.
Once your applications moved to the cloud and your people started working from anywhere, the perimeter went with them.
Identity is the control plane now, and Sophos found that 79% of ransomware attacks in the past year started with an identity-based approach, so that’s where the design starts.
Strong MFA, access decisions based on device and risk, and admin rights handed out only when needed are the non-negotiables.
For organisations adopting Microsoft 365, security should be built around identity protection, conditional access, privileged access controls and Zero Trust principles.
Zero Trust is the posture that holds it together, and it’s worth saying plainly that it’s a posture, not a product on a price list.
The other half of defending better is patching at the pace the threat moves.
IBM’s 2026 research warns that frontier AI models will collapse the time between vulnerability discovery and exploitation, with attackers abandoning human speed for machine speed, while most mid-market estates still patch in around a month.
For many organisations, vulnerability management and patch management have become critical cybersecurity priorities as AI-driven attacks reduce the time available to respond.
A monthly change-advisory cycle belongs to an era that’s gone.
The gap between how fast attackers move and how fast you patch is, for many businesses, the single biggest exposure they can measure.
For more on how AI is changing the threat landscape, read our related article: “Security Is About to Lose Its Most Valuable Asset: Time”.
You Probably Already Own Most of It
Most mid-market businesses are running either Microsoft 365 Business Premium or E3, and both already carry more of this architecture than they’re using.
Map what you hold against the framework and the gap between what you’re paying for and what you’ve actually switched on gets hard to ignore.
The prevention layer, delivered by licences most mid-market businesses already hold.
Both plans already cover the fundamentals: controlling who gets access and enforcing MFA, managing and hardening devices, keeping systems patched, and defending email against phishing.
Business Premium goes a step further with endpoint protection built in.
Between them they handle the entire prevention layer and every Cyber Essentials control, so certification is usually less about buying anything and more about turning on what you already pay for.
And once you’re ready to take security beyond the essentials (the clue is in the name, after all), there are higher-tier SKUs that help you do it, adding the risk-based access and threat detection that cover the rest of the framework.
The work that pays off most is rarely a new purchase. It’s using what you already own before adding anything new.
Many organisations can improve Microsoft 365 security posture significantly without increasing licensing costs, simply by enabling security features that are already included within their existing subscriptions.
Respond Faster: What Prevention Alone Misses
Detect, Respond and Recover are the parts a prevention-only mindset leaves wide open, and where most mid-market estates are thinnest.
Detection has to reach across your whole estate and land somewhere a person will act on it, whether that’s your own team or a managed service.
The question that decides whether it works isn’t which product you bought.
It’s who is watching at 3am and what they’re allowed to do without waking someone up first.
Responding well means deciding the hard things in advance: who runs the incident, who can authorise pulling a system offline, and who talks to customers and regulators.
The cheapest control with the biggest payback is one most people still skip, a two-hour tabletop each quarter with the people who’d actually be on the call.
And “we’ve got backups” is not the same as being able to restore, at the speed the business needs, from a copy the attacker couldn’t reach.
Rehearsing that restore is what turns a disaster into “just” a bad week.
This is where cyber incident response planning, security monitoring, disaster recovery and cyber recovery exercises become essential rather than optional.
A starting baseline, not a target to aspire to.
The upside of getting this right is that you can put numbers to it and report against them, which is a discipline worth having in its own right.
The KPIs above are the bare minimum you should be aiming for.
If your organisation cannot currently meet them, that is the gap to close first.
If you can, the next conversation is about tightening them, because attackers are not working to your service levels.
Get it wrong and the bill is stark: the average UK data breach now runs to £3.13M, and the average cost of recovering from a ransomware incident has climbed 11% in a year to $1.7M, before any ransom is paid.
What This Means for You
You won’t out-spend an attacker, but you can out-prepare one, and a framework gives you both the discipline and the shared language to do it.
Three questions worth reflecting on:
• Can you name the framework your security maps to? If the answer is a list of products, you’re throwing things at the wall and hoping.
• Are you paying twice, buying security you may already own? If so, the quickest win available to you costs nothing extra.
• Where are you weakest right now: stopping it, spotting it, responding to it or recovering from it? If Detect, Respond or Recover gets a shrug, you’ve certified the floor and left the rest of the house open.
The mid-market doesn’t need a bigger security budget than the enterprise. It needs a framework to align to and the discipline to run it. Everything else is just throwing money at the wall.
Summary
Mid-market organisations face the same cyber threats as large enterprises but often without the same security resources. A security architecture built around NIST Cybersecurity Framework 2.0, Cyber Essentials Plus, Zero Trust principles and effective detection, response and recovery capabilities provides a practical foundation for cyber resilience. Before investing in additional security products, organisations should first evaluate whether they are fully utilising the security capabilities already available within Microsoft 365 and other existing platforms.
Frequently Asked Questions
What is the best cybersecurity framework for a mid-market business?
NIST Cybersecurity Framework 2.0 is one of the most widely adopted frameworks because it helps organisations align security controls across governance, protection, detection, response and recovery.
Is Cyber Essentials Plus enough protection on its own?
No. Cyber Essentials Plus provides a strong foundation and protects against many common attacks, but it focuses primarily on prevention. Organisations also need monitoring, incident response and recovery capabilities to achieve true cyber resilience.
Why is identity security so important in 2026?
Many modern cyberattacks, including ransomware incidents, begin with compromised identities rather than network breaches. Strong MFA, Conditional Access, least privilege access and Zero Trust principles help reduce this risk.
Does Microsoft 365 include cybersecurity tools?
Yes. Microsoft 365 Business Premium and Microsoft 365 E3 include a range of security capabilities covering identity protection, endpoint management, patching, phishing protection and device security. Many organisations are not fully utilising these features.
How often should incident response plans and disaster recovery processes be tested?
Defence in depth is a cyber security strategy that uses multiple layers of security controls, such as Zero Trust, endpoint protection, network segmentation and privileged access management, to reduce risk and limit the impact of a successful attack.
Why is speed becoming more important in cyber security?
At a minimum, organisations should conduct regular tabletop exercises and test backup restoration processes to verify that recovery objectives can be met during a real incident.